Sign up to receive free email alerts when patent applications with chosen keywords are publishedSIGN UP

Abstract:

A system for discovering bugs comprises an input interface and a
processor. The input interface is configured to receive a bug definition.
The bug definition includes a set operator with a time constraint and one
or more set operands. The input interface is configured to receive an
event log. The processor is configured to determine a list of bug
occurrences using the bug definition and the event log.

Claims:

1. A system for discovering bugs, comprising: an input interface
configured to receive an event log; a processor configured to: parse the
event log to build an event symptom database; evaluate a bug definition
on the event symptom database to determine whether a bug as defined by
the bug definition has occurred; and provide a list of bug occurrences;
and a memory coupled to the processor and configured to provide the
processor with instructions.

2. The system of claim 1, wherein the event log comprises a text file of
software status messages.

3. The system of claim 1, wherein the event system database comprises a
structured database of software status messages.

4. The system of claim 1, wherein the event system database stores a
symptom type.

5. The system of claim 1, wherein the event system database stores a
symptom status.

6. The system of claim 1, wherein the event system database stores a
symptom variable.

7. The system of claim 1, wherein the event system database stores a
symptom time.

8. The system of claim 1, wherein the bug definition comprises a set of
rules for identifying bugs.

9. The system of claim 8, wherein a rule for identifying bugs comprises
an event symptom condition.

10. The system of claim 1, wherein the bug definition comprises a set
operator.

11. The system of claim 10, wherein the set operator comprises one or
more of the following: overlaps, during, starts, finishes, and, or, xor,
not, or times.

12. The system of claim 10, wherein the set operator includes a time
constraint.

13. The system of claim 12, wherein the time constraint includes a time
constraint relation.

14. The system of claim 13, wherein the time constraint relation
comprises one of the following: less than, less than or equal to, greater
than, greater than or equal to, or equal to.

15. The system of claim 12, wherein the time constraint includes a time
constraint value.

16. A method for discovering bugs, comprising: receiving an event log
parsing, using a processor, the event log to build an event symptom
database; evaluating a bug definition on the event symptom database to
determine whether a bug as defined by the bug definition has occurred;
and providing a list of bug occurrences.

17. A computer program product for discovering bugs, the computer program
product being embodied in a tangible computer readable storage medium and
comprising computer instructions for: receiving an event log parsing,
using a processor, the event log to build an event symptom database;
evaluating a bug definition on the event symptom database to determine
whether a bug as defined by the bug definition has occurred; and
providing a list of bug occurrences.

Description:

[0001] CROSS REFERENCE TO OTHER APPLICATIONS

[0002] This application is a continuation of co-pending U.S. patent
application Ser. No. 14/040,397, entitled SYSTEM FOR DISCOVERING BUGS
USING INTERVAL ALGEBRA QUERY LANGUAGE filed Sep. 27, 2013 which is
incorporated herein by reference for all purposes.

BACKGROUND OF THE INVENTION

[0003] Typically, when technical support personnel receive bug reports
from customers, they analyze logs manually to find bugs. They often
maintain a bug database or knowledge base that describes the symptoms of
each bug. For example, the bug entitled, "File System Outage after Drive
Failure" in the bug database would be described as: Having more than two
occurrences of "Input/Output channel reset" within one hour after the
occurrence of the message, "Device identifier not available" reported in
the log file. Technical support personnel manually search logs for
matches of the bug symptoms described within the bug database. Although
such a bug discovery process is effective, the process is highly
labor-intensive and therefore, inefficient and prone to human error.

BRIEF DESCRIPTION OF THE DRAWINGS

[0004] Various embodiments of the invention are disclosed in the following
detailed description and the accompanying drawings.

[0005] FIG. 1 is a block diagram illustrating an embodiment of a system
for discovering bugs.

[0006] FIG. 2 is a block diagram illustrating an embodiment of a system
for discovering bugs.

[0007] FIG. 3 is a flow diagram illustrating an embodiment of a process
for discovering bugs.

[0008] FIG. 4 is a table illustrating an embodiment of operators.

[0009] FIG. 5 is a table illustrating an embodiment of operators.

DETAILED DESCRIPTION

[0010] The invention can be implemented in numerous ways, including as a
process; an apparatus; a system; a composition of matter; a computer
program product embodied on a computer readable storage medium; and/or a
processor, such as a processor configured to execute instructions stored
on and/or provided by a memory coupled to the processor. In this
specification, these implementations, or any other form that the
invention may take, may be referred to as techniques. In general, the
order of the steps of disclosed processes may be altered within the scope
of the invention. Unless stated otherwise, a component such as a
processor or a memory described as being configured to perform a task may
be implemented as a general component that is temporarily configured to
perform the task at a given time or a specific component that is
manufactured to perform the task. As used herein, the term `processor`
refers to one or more devices, circuits, and/or processing cores
configured to process data, such as computer program instructions.

[0011] A detailed description of one or more embodiments of the invention
is provided below along with accompanying figures that illustrate the
principles of the invention. The invention is described in connection
with such embodiments, but the invention is not limited to any
embodiment. The scope of the invention is limited only by the claims and
the invention encompasses numerous alternatives, modifications and
equivalents. Numerous specific details are set forth in the following
description in order to provide a thorough understanding of the
invention. These details are provided for the purpose of example and the
invention may be practiced according to the claims without some or all of
these specific details. For the purpose of clarity, technical material
that is known in the technical fields related to the invention has not
been described in detail so that the invention is not unnecessarily
obscured.

[0012] A system for discovering bugs using an interval algebra query
language is disclosed. A system for discovering bugs comprises an input
interface configured to receive a bug definition, wherein the bug
definition includes a set operator with a time constraint and one or more
set operands, and to receive an event log. The system for discovering
bugs additionally comprises a processor configured to determine a list of
bug occurrences using the bug definition and the event log. The system
for discovering bugs additionally comprises a memory coupled to the
processor and configured to provide the processor with instructions.

[0013] A system for discovering bugs receives and processes an event log
(e.g., generated in response to a software error) in order to determine
the software bug that caused the error. Rather than reading the log
manually and searching for patterns that indicate a particular bug, the
system for discovering bugs processes the event log to put it in a
structured format, for instance a searchable database (e.g., an SQL
database). The structured event log is then processed by a bug identifier
module to identify the bug that caused the error. The bug identifier
module is configured with one or more bug definitions that are processed
into query commands for the structured event log. Bug definitions
comprise set operators that process set operands.

[0014] FIG. 1 is a block diagram illustrating an embodiment of a system
for discovering bugs. In the example shown, user system 102 runs software
developed by a developer (e.g., using software developer system 104).
When the system runs, it generates an event log. The event log is sent to
software development server 106 via network 100. Software development
server 106 processes the event log to identify bugs. The bugs or list of
bugs can be communicated to user system 102 or software developer system
104 for correction, if appropriate.

[0015] In various embodiments, network 100 comprises one or more of the
following: a local area network, a wide area network, a wired network, a
wireless network, the Internet, an intranet, a storage area network, or
any other appropriate communication network. In the example shown, user
system 102 comprises a user system (e.g., a computing system for
operation by a user). In various embodiments, there are 1, 6, 22, 122,
1059, or any other appropriate number of user systems communicating with
network 100. In some embodiments, user system 102 comprises a system
accessed by a user directly (e.g., the user is in proximity with user
system 102). In some embodiments, user system 102 comprises a system
accessed by a user remotely (e.g., the user is not in proximity with user
system 102, and accesses user system 102 via network 100 and a separate
user system). A user interacts with software running on user system 102.
In some embodiments, the software was developed by a software developer
(e.g., a software developer using software developer system 104). In
various embodiments, software development server 106 comprises software
developed by a software developer, software development tools,
communications from a software user, a system for discovering bugs, or
any other appropriate software. In some embodiments, software running on
user system 102 contains bugs. In some embodiments, in the event that
software running on user system 102 fails (e.g., crashes, etc.) the
software produces an event log that can be delivered to software
development server 106. A system for discovering bugs analyzes the event
log to determine the bug that was the cause of the software failure.

[0016] FIG. 2 is a block diagram illustrating an embodiment of a system
for discovering bugs. In some embodiments, system for discovering bugs
200 runs on a software development server (e.g., software development
server 106 of FIG. 1). In the example shown, system for discovering bugs
200 receives event log 210 (e.g., from a software user of software user
system) and bug definition 212 (e.g., from a software developer of
software developer system). In some embodiments, the event log comprises
an event log produced by a software program in response to a failure. In
some embodiments, the event log includes system status (e.g., CPU usage,
CPU temperature, etc.). Event log parser 202 receives the event log and
parses it to produce event symptom database 204. In some embodiments, the
received event log (e.g., event log 210) comprises a text file of
software status messages. In some embodiments, event symptom database 204
comprises a structured database (e.g., an SQL database) of software
status messages. In various embodiments, event symptom database 204
comprises columns for one or more of the following: symptom type, symptom
status, symptom variables, symptom time, or any other appropriate event
symptom information. Bug identifier module 206 receives bug definition
212. In some embodiments, bug definition 212 comprises a set of rules for
identifying bugs. In some embodiments, the rules for identifying bugs
comprise event symptom conditions (e.g., conditions of event symptoms
stored in event symptom database 204). For example, a bug definition
could describe a first event symptom (e.g., system activity over 80%)
occurring and lasting for at least 30 seconds, then stopping and followed
no more than 1 second later by a second event condition (e.g., hard drive
accesses overload). In some embodiments, a bug definition comprises a set
operator (e.g., an operator such as BEFORE, AFTER, EQUALS, OVERLAPS)
operating on one or more sets (e.g., sets of occurrences of event symptom
conditions). For instance, the set operator OVERLAPS receives two sets as
input. Each set is a set of rows, e.g., from event symptom database 204,
describing occurrences of an event condition. In some embodiments, the
output of a set operator is always a set. In some embodiments, set
operators are always composable (e.g., any set operator can take the
output of any other set operator as one of its inputs). In some
embodiments, a set operator comprises a chain of set operators (e.g.,
multiple composed set operators). The set operator OVERLAPS outputs a set
of occurrences of the condition that the two conditions overlap (e.g. the
set includes an indication of true anywhere the two conditions occur at
the same time and false anywhere else). In some embodiments, the set
operator includes a time constraint (e.g., two conditions are only
considered to overlap if they are determined to overlap for at least 0.5
seconds). Bug identifier module 206 loads the bug definitions from bug
definition 212 and searches event symptom database 204 automatically to
find the event symptom patterns described in the bug definition.
Instances in event symptom database 204 of the patterns described in bug
definition 212 are identified by bug identifier module 206 and output as
part of bug list 208. In some embodiments, a software developer receives
bug list 208 and attempts to fix the bug or bugs identified.

[0017] FIG. 3 is a flow diagram illustrating an embodiment of a process
for discovering bugs. In some embodiments, the process for discovering
bugs is executed by a system for discovering bugs (e.g., system for
discovering bugs 200 of FIG. 2). In the example shown, in 300 a bug
definition is received, wherein the bug definition includes a set
operator with a time constraint and one or more set operands. In 302, an
event log is received. In 304, a list of bug occurrences is determined
using the bug definition and the event log.

[0018] A methodology of discovering bugs via an interval algebra based bug
query language is disclosed. The most relevant operations on discrete
events for bug discovery are identified and augmented with semantics in
time constraints. The composability of those operations allows a bug
query language that enables simple to arbitrary and complex expressions
to capture numerous bug patterns.

[0019] An interval is a space between two objects, points, or units. A
time interval is the temporal interval period between two moments on a
timeline. We use two kinds of time interval: (1) Time interval between
two events, and (2) Time interval of a single event's start point and end
point. The time interval between two events is the foundation upon which
interval algebra operators are built. The time interval of an event's
start point and end point is the input and output of interval algebra
operators.

[0020] FIG. 4 is a table illustrating an embodiment of operators. In the
example shown, thirteen basic interval algebra operators are defined:
BEFORE, AFTER, EQUALS, MEETS, OVERLAPS, DURING, STARTS, FINISHES, AND,
OR, XOR, NOT and TIMES. The table shows 4 columns the operation name, the
operation symbol, an example of usage, and a description. In this table,
X and Y are two kinds of events, where x and y are each a single event of
set X and set Y. In these thirteen operations, EQUALS, MEETS, OVERLAPS,
STARTS, FINISHES, AND, OR and XOR are commutative operations. They get
the same result in the case that left operand and right operand are
switched. BEFORE, AFTER, EQUALS, STARTS, FINISHES, AND, OR and XOR are
associative operations.

[0021] Inputs of interval algebra operators are events with a time
interval (start point and end point). Outputs of these operators are new
events with a time interval. For example, the operator "MEETS" means the
end-point of X meets the start-point of Y or end-point of Y meets the
start-point of X. The new time interval of the output event is
calculated. Usually they are equal to [min(startof(X), startof(Y),
max(endof(X), endof(Y))]. "min" means the smaller (or equally small) one
of inputs. "max" means the bigger (or equally big) one of input.
"startof" means start point of event. "endof" means end point of event.

[0022] FIG. 5 is a table illustrating an embodiment of operators. In the
example shown, to discover bugs, basic interval algebra operators are not
sufficient in practice. For example, if we want to find a bug where event
X occurs after event Y with a time distance of less than one hour, the
basic AFTER operator is insufficient. To overcome this limitation, There
are time constraints on eight operators: BEFORE, AFTER, OVERLAPS, STARTS,
FINISHES, AND, XOR and TIMES. Time constraints are not applicable to the
other four operators, EQUAL, MEETS, DURING and OR. FIG. 5 shows how time
constraints are used with interval algebra operators.

[0023] The expression of the bug query language is called a "bug query
expression". It is composed of events, interval algebra operators, and
time constraints. A bug query expression can be used to express bug
patterns that are indicated by events with time interval information.
Interval algebra based bug query language has two important features: (1)
Output of an expression can be an input of another expression. Output of
a bug query expression is a new set of events. Therefore, they can be
used as an operand in its enclosing expression. This feature ensures bug
query expression is composable. (2) The criterion of judging bugs is
whether the result set is empty. A monitored system is deemed to have the
corresponding bugs if the evaluation result of the expression is not
empty. Otherwise, it is free of that bug.

[0024] There are 3 steps to scan a bug.

[0025] 1. Define a bug query expression for a given bug. For example:
"(X<[≦1 h] Y) D Z" means it has a bug if the following two
conditions are satisfied: (1) Event X occurs no more than 1 hour ahead of
event Y. (2) Time periods of both X and Y that matched the first
condition are in Z's time period.

[0028] In practice, bug scan operations are evaluated within a specific
time period since you may get different results depending on the
"evaluation space". For example, if you search for bugs with 3 days' (the
evaluation space) event logs, you may get different results than if you
search for bugs using event logs for 5 years.

[0029] Although the foregoing embodiments have been described in some
detail for purposes of clarity of understanding, the invention is not
limited to the details provided. There are many alternative ways of
implementing the invention. The disclosed embodiments are illustrative
and not restrictive.

Patent applications by Bo Chen, Shanghai CN

Patent applications by Christopher Hercules Claudatos, San Jose, CA US